Will it be a problem to perform DML on an object where the user never have access? Will it lead to salesforce audit violation kind of thing if I implement this?

Use Case: Trying to perform DML statement on the opportunity for customer community license type users. I can able to perform the DML and able to update without any issues by using wrapper classes to display the data

  • Could you elaborate your scenario.
    – Prathyusha
    Commented Feb 2, 2021 at 8:06
  • Our system is designed to work with opportunity and its products to service our customers. Now we are planning to enable customers to self login and update created opportunity by their own & asking them to add/remove products they want. Since customer community license doesn't support opportunity object to work with as per the profile I was thinking to use apex and vf page to create custom pages and perform DML via system context. is this something going to be an issue with salesforce audit if we do? Commented Feb 7, 2021 at 16:41

2 Answers 2


You can perform DML if your class has a without sharing Clause. Also, you can display the data on UI if you have a wrapper class. But you can't do so by referring to the object itself.

For Example:

If you are returning a list of Opportunities from the AuraEnabled apex method, if this method is called in the customer community context, you will run into an error as Opportunity is not supported in Customer Comm. Similarly, you won't be able to access the VF merge fields of Opportunity like {!oppObj.Name}. Having the wrapper class solves your problem.

Also, you can't call any apex method from Aura/LWC which is referring to the Opportunity in this context, you need to use the wrapper here as well.

  • I am ready to use wrapper variables everywhere, is it a violation(salesforce audit) to perform DML against the profile where the object is unaccessible ? Commented Feb 3, 2021 at 9:08
  • @KumaresanM Yes, it is, but you can put that in the false positive report so salesforce. Also, you need to mention the reason behind why you are doing this. a false-positive report is a simple excel file that you can submit to salesforce along with the code scan report. Commented Feb 3, 2021 at 9:51
  • How do we execute this scan report & request salesforce? Could you please suggest the steps. Commented Feb 7, 2021 at 16:43
  • @KumaresanM You can do the security scan here, also when you will submit the report to Salesforce for review, there you can share the false positive report as well. Commented Feb 8, 2021 at 6:37

You can write the DML statement in a method on an Apex Class that is declared "without sharing" so the action runs as the System User.

Documentation Link: https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_classes_keywords_sharing.htm

  • I am ready to use wrapper variables everywhere, is it a violation(salesforce audit) to perform DML against the profile where the object is unaccessible? Commented Feb 3, 2021 at 9:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .